Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/10/2022, 17:44

General

  • Target

    srv.html

  • Size

    12KB

  • MD5

    7d02a4656feaf477fe181096c8537030

  • SHA1

    a7eddf9d0e79d0820621ce35e91ac3180b220d5a

  • SHA256

    ae774d29cb04152971f0ee8f3f06d6f5b8b77f84bd776366dad4685cd4567a68

  • SHA512

    5a512563b18cb08805eb396931c3611c9390bc87dba76cbafdfcd4d9aec1265400689b47fa422a9cb749543e48f2a1496ef56c29ef59410b505bc04dfbd7b40d

  • SSDEEP

    384:4Xwxzh/MNiHxCHv97Q5qh0bbtiZ5nF9bWzrPdy41E:4XcHU65ou0Z5nFFWzrPdy41E

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 41 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\srv.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4676
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4676 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:4864

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\ru1r3yf\imagestore.dat

    Filesize

    8KB

    MD5

    af406d273b78ff708574756593a15146

    SHA1

    800276925348c2731eb62f105fa97fa9a5b2dab1

    SHA256

    334685e70a048502d011348e192e6212a9c75ec90a12eca04514eec33f023441

    SHA512

    efb5c36c3ed2429c9744ea61fb8d0957660e39f40a1cacfc21c36d89a06447a4bbebae6550f525c35e3887729d30cac9fc53e7251c57d7cb618780e2c8a66b80

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GMQ6XNBF\favicon[2].ico

    Filesize

    14KB

    MD5

    08688ec246caa64b55f284a348008c48

    SHA1

    9d7196c2fdf65c05dbab8ab74c593a581d2f09b0

    SHA256

    fac5680d7feb5d6b0a4f4caa95868bf3b7a26c85699b2fc9ace6f96f40ab1dc1

    SHA512

    2f0e9a07a3ab5693438845895cb9ffbbfa4dce01e9340cf929d5ef4fdef25c3001bb264503a21b51fd4030da39f3857e2071c1c477cf888b6b9eb7f07b06e7d0

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S58XVZL8\favicon[1].ico

    Filesize

    7KB

    MD5

    21dfe1c3d1424af7dc63f2216d16871e

    SHA1

    4c8103880775e1be6ef6a8e7490c33a77fea70fa

    SHA256

    a2094fafab274c1dce798478b6f8ecce80f7fdfa6aa7eb88a625ce8c3dfe683c

    SHA512

    8b64fe9c85e04a6eb588a9fb74f964e2105b643638ad6a5f68691947a003e1c124a08549344589571baa22ea802a9f791e455ce088cf10b7f53b5011e154fe7b